Board and management reporting for security

Scope: register to board decision · Who: the officer who presents · Prerequisites: a populated risk register and a standing forum · First result: one reporting cycle

1. Why this exists (the failure mode it prevents)#

The security update that fails is the one that reports activity. Slide counts. Training completion percentages. A sentence saying there were no major incidents this quarter. The item closes, everyone is satisfied, and nothing was decided.

Three symptoms follow, and each of them surfaces later as a finding.

The first is the approval nobody remembers giving. Risk criteria were shown on a slide, no one objected, and the minute records the item as noted. When an assessor asks who approved the criteria and on what date, there is a deck rather than a decision.

The second is the risk accepted in conversation. A treatment was too expensive, the exposure was described as tolerable, and the meeting moved on. Nothing records who accepted the residual risk, at what level, or until when.

The third is the management review that cannot show its own inputs. ISO/IEC 27001:2022 clause 9.3 is titled "Management review", with 9.3.2 "Management review inputs" and 9.3.3 "Management review results" ¹. Minutes recording attendance and a thank-you satisfy neither sub-clause.

There is a legal reason as well as an operational one. Directive (EU) 2022/2555 puts the management bodies of essential and important entities under two duties and one exposure. They approve the cybersecurity risk-management measures taken to comply with Article 21. They oversee the implementation of those measures. And they can be held liable for the entity's infringements of that Article ². Approval and oversight are acts. Neither happens by being present while a deck is shown.

The financial sector has the same structure in different words. Under Regulation (EU) 2022/2554, the management body of a financial entity defines, approves, oversees and is responsible for implementing the arrangements related to the ICT risk management framework. It bears ultimate responsibility for managing that entity's ICT risk ³.

This playbook converts the update into a decision item. The reader is the officer who has to put security in front of a board or an executive committee and leave with something recorded.

2. Definitions (only the ones that cause disputes)#

Six terms account for most of the confusion between a security function and the body it reports to. Requirement text in both standards is copyright and is paraphrased here; only titles are quoted.

Term	Working definition	Source
Information item vs decision item	An information item asks the body to know something. A decision item asks it to choose, and names the options, the recommendation and the consequence of not choosing. Agendas that carry only the first produce no record of governance.	Working distinction; not a clause of either standard
Risk criteria and appetite	Criteria are the published rules for scoring and for what is acceptable. Appetite is the level of exposure the body has said it will hold without further treatment. Both are approved, not assumed.	Clause 6.1.2 4 and GV.RM-02, where risk appetite and risk tolerance statements are established, communicated and maintained 5
Metric, indicator, target	A metric is a measured quantity. An indicator is a metric chosen because movement in it says something about exposure. A target is the value the body has agreed to hold the indicator at.	Clause 9.1, titled "Monitoring, measurement, analysis and evaluation" 6
Management review	Top management's scheduled review of the management system, with defined inputs and recorded results. It is the clause the board pack answers to, and the minute is the evidence.	Clauses 9.3, 9.3.2 and 9.3.3 1
Duties of the management body	Approve the risk-management measures, oversee their implementation, can be held liable for the entity's infringements, and follow training so risks can be identified and practices assessed.	Article 20(1) and 20(2) 7; Article 5(2) and 5(4) for financial entities 8
Profile and Tier	A Current Profile states the outcomes an organisation is achieving and how far. A Target Profile states the desired outcomes it has selected and prioritised. Tiers characterise the rigour of risk governance and management practice.	Sections 3.1 and 3.2 9 10

GOVERN is the CSF 2.0 Function that has an organisation establish, communicate and monitor its cybersecurity risk management strategy, expectations and policy ¹¹. Six Categories sit under it, and they are the agenda of any board that governs security seriously ¹²:

• Organizational Context (GV.OC)
• Risk Management Strategy (GV.RM)
• Roles, Responsibilities, and Authorities (GV.RR)
• Policy (GV.PO)
• Oversight (GV.OV)
• Cybersecurity Supply Chain Risk Management (GV.SC)

3. The method — numbered steps, each with input, activity, output and owner#

Eight steps in dependency order. Audience before question, question before content, content before rhythm, rhythm before follow-through. Skipping to the pack is the commonest error, and it is why so many packs are beautiful and inert.

3.1 Name the audience and its decision rights#

There is rarely one body. A board approves the framework and the appetite. An executive committee funds treatment and owns cross-function decisions. A security forum triages and prepares. Reporting the same content to all three wastes the only scarce resource in the room, which is attention.

Write the decision-rights map first: for each body, what it may approve, what it may only advise on, its quorum, its cadence, and where its decisions are recorded. ISO/IEC 27001:2022 clause 5.1 is "Leadership and commitment" and clause 5.3 "Organizational roles, responsibilities and authorities" ^{13 14}. The Annex A counterpart is ISO/IEC 27002:2022 control 5.2 "Information security roles and responsibilities". It asks that roles and responsibilities be defined and allocated to suit the organisation's needs, including responsibility for accepting residual risk ¹⁵.

CSF 2.0 puts the same expectation at GV.RR. Leadership there is accountable for cybersecurity risk, and roles, responsibilities and authorities are established, communicated, understood and enforced ¹⁶.

• Input: terms of reference for each body, the delegation of authority, the current committee calendar.
• Activity: list every body that receives security content; record what each may decide; identify the risk owners who sit in each; delete any body that receives without deciding.
• Output: decision-rights map, one page, approved by the chair of each body.
• Owner: the security officer drafts; each chair confirms their own row.

The map settles an argument before it starts: when a decision is escalated, it says which body takes it.

3.2 Write the question the board must answer this quarter#

One question per cycle, written before any slide exists. Four archetypes cover almost everything a security function needs from a board.

Approve the criteria. The scales, the acceptance thresholds and the appetite statement are put for approval, and the approval is dated. Clause 6.1.2 is titled "Information security risk assessment" ⁴.

Accept a named residual risk. One risk, at a stated level, with the treatment options and their costs, an owner, and an expiry date on the acceptance. Clause 6.1.3 is "Information security risk treatment" ¹⁷.

Fund a treatment. The exposure, the option set, the cost, and what the exposure becomes if nothing is funded. GV.RR-03 expects resources allocated commensurate with the risk strategy, roles, responsibilities and policies ¹⁶.

Confirm the scope or the objectives. What is inside the system, what changed, and which objectives stand for the coming period. Clause 6.2 is "Information security objectives and planning to achieve them" ¹⁸.

• Input: the register, the open decisions from last cycle, the objectives register, the change and incident record.
• Activity: choose one question; write it as a single sentence a non-specialist can answer; state the recommendation and the consequence of deferring.
• Output: the decision request, one paragraph, at the top of the pack.
• Owner: the security officer, agreed with the chair before the papers go out.

If no question can be written, the item is information and belongs in a written update rather than on an agenda.

3.3 Choose five to seven risks and say what each one needs#

The register is not the report. A board can hold five to seven items in mind and decide on one or two of them. More rows produce a scan rather than a discussion, and a scan produces no decisions.

Select on materiality and movement, not on score alone. Each selected row carries five things: the risk stated as source, event and consequence; the named owner role; its position against appetite; its direction since last cycle; and the decision requested, if any. The method for writing the underlying rows is in The risk register other people trust, and the register itself in the risk register template. Neither is repeated here.

Position against appetite is the column boards actually use. Three values are enough: within appetite, at appetite, beyond appetite. A row beyond appetite either carries a funded treatment plan or a dated acceptance, and saying which is the whole point of the report.

• Input: the current register, the acceptance records with their expiry dates, the treatment plan.
• Activity: filter to material rows; sort by position against appetite; add the trend; attach a decision request to every row beyond appetite; move everything else to the annex.
• Output: the selected risk set, five to seven rows, each with owner, position, trend and decision.
• Owner: the security officer selects; risk owners confirm their own rows before publication.

Confirming with the risk owner before publication removes the worst moment in board reporting, which is a risk owner learning their exposure from a slide.

3.4 Report measures of control, not measures of activity#

Activity metrics count what the security function did. Control metrics say whether a control worked. Boards are shown the first and need the second.

The distinction is testable. A metric is a control metric if a failing value forces a decision. Training completion at 94 per cent forces nothing. Privileged accounts without a review in the last quarter forces either a remediation date or an acceptance.

ISO/IEC 27001:2022 clause 9.1 is titled "Monitoring, measurement, analysis and evaluation" ⁶. The practical set is small: no more than eight to ten measures, each with a definition, a source system, an owner role, a frequency and a target. Definitions belong beside the metric, because a metric whose definition moves cannot show a trend.

Two Annex A controls sit under most reportable numbers. ISO/IEC 27002:2022 control 8.16 "Monitoring activities" asks that networks, systems and applications be monitored for anomalous behaviour, with action taken to evaluate potential incidents ¹⁹. Control 5.36 "Compliance with policies, rules and standards for information security" asks that compliance with the organisation's own policies and standards be reviewed regularly, with results recorded ²⁰. CSF 2.0 names the receiving end. Under GV.OV Oversight, the results of organisation-wide risk management activity and performance feed back into the strategy, to inform it, improve it and adjust it ²¹. Reporting that changes nothing is not oversight.

• Input: control inventory, source systems, previous periods' results, the objectives register.
• Activity: pick the measures whose failure forces a decision; write each definition once; agree targets with the owner role; publish the trend rather than a single value.
• Output: the metric set, with definitions, targets and at least three consecutive periods.
• Owner: control owners supply values; the security officer owns the definitions.

A set that is green every period is a warning, not a comfort. It usually means the thresholds were set at what the organisation already achieves.

3.5 Build the one-page risk picture#

One page, above the fold: the selected risk rows, the decision requested against each, and the position against appetite. Everything else is an appendix, including the full register, the metric definitions, incident detail and programme status.

The Profile idea from CSF 2.0 is a useful shape for the page. A Current Profile states the outcomes being achieved and to what extent. A Target Profile states the desired outcomes, selected and prioritised, and the gap between them becomes a prioritised action plan ⁹. Boards read a current position, a target and a gap far better than a heat map.

Tiers are the other communication device, and the one most often misused. Tiers grade how rigorous an organisation's risk governance and management practices are, from Partial through Risk Informed and Repeatable to Adaptive. They complement a risk management methodology rather than replacing it ¹⁰. A Tier is context for a conversation about rigour. It is not a score, and presenting it as one invites a target that means nothing.

• Input: the selected risk set, the metric set, the open decisions, the acceptances expiring before the next meeting.
• Activity: fit the above-the-fold content on one page; put every supporting table in the appendix; give the page a version and a date.
• Output: the one-page risk picture — see the template.
• Owner: the security officer produces it; the chair approves the agenda placement.

If the page needs a legend to be read, it is not yet the page.

3.6 Make the management review the operating rhythm#

The board pack and the management review are the same artefact seen from two sides. Clause 9.3.2 is "Management review inputs" and clause 9.3.3 is "Management review results" ^{22 23}. Build the pack so that its sections are the inputs, and the minute is the results. Nothing then has to be reconstructed for an assessor.

Two Annex A controls hold the rhythm in place. ISO/IEC 27002:2022 control 5.1 is "Policies for information security". It asks that the policy and topic-specific policies be approved by management, communicated, and reviewed at planned intervals and on significant change ²⁴. Control 5.4 "Management responsibilities" asks management to require all personnel to apply information security in line with the established policies and procedures ²⁵. Both are reported against, not merely asserted.

An independent view belongs in the same rhythm. ISO/IEC 27002:2022 control 5.35 is "Independent review of information security". It asks that the approach to managing information security and its implementation be reviewed independently at planned intervals, or on significant change. Results go to the management who initiated the review and, where appropriate, to top management ²⁶. A board that only ever hears from the function it funds has no calibration.

• Input: the risk picture, metric set, audit and finding status, incident summary, supplier assurance status, previous decisions.
• Activity: map each pack section to a review input; hold the review on the published date; record results as decisions.
• Output: the management review record, filed with its input pack.
• Owner: top management performs the review; the security officer convenes and records.

3.7 Record the decision, then chase it#

A decision that is not written down did not happen. The minute needs four fields per item and no more: what was decided, who owns it, by when, and what evidence will show it is done.

Keep a standing decision log across cycles, separate from the minutes. It answers what an assessor asks in the second hour: what happened to the decision taken three meetings ago. Every row carries the date, the decision, the risk identifier, the deciding role, the follow-up and its status.

Where a decision follows a nonconformity, clause 10.2 "Nonconformity and corrective action" is the clause the follow-through answers to ²⁷. The practical discipline is the same one that governs an audit finding: correction and cause are different fields, and closure needs evidence rather than an assertion. That mechanism is set out in the findings-to-closure tracker.

• Input: the decisions taken in the meeting, the open items from previous cycles.
• Activity: write each decision in the four fields; assign the owner in the room; carry every open item forward until it closes on evidence.
• Output: the decision log, current, with an open-item age for each row.
• Owner: the secretary of the body records; the security officer tracks closure.

Opening the next meeting with overdue decisions rather than new content changes behaviour faster than any escalation policy.

3.8 Set the cadence and the pack#

Three rhythms cover almost every organisation.

Quarterly, the risk picture with a decision request. Annually, the management review across the whole system, including scope, objectives, audit results and improvement. On a material incident or a material regulatory change, a briefing inside the window the body needs to act rather than at the next scheduled meeting.

Training is part of the cadence, not an extra. Article 20(2) of Directive (EU) 2022/2555 requires the members of management bodies in essential and important entities to follow training. Member States must also encourage those entities to offer similar training to employees regularly, so risks can be identified and practices assessed ²⁸. For financial entities, Article 5(4) of Regulation (EU) 2022/2554 asks the same. Management body members keep their knowledge and skills up to date, including by following specific training regularly and proportionately to the ICT risk managed ²⁹.

The measures the body approves are the ones Article 21 of Directive (EU) 2022/2555 requires. They are appropriate and proportionate technical, operational and organisational measures for the risks to the network and information systems used, on an all-hazards approach ³⁰. A pack that never shows those measures gives the body nothing to approve.

• Input: the committee calendar, the regulatory horizon, the incident classification thresholds.
• Activity: publish the cadence and the paper deadlines; agree the trigger for an out-of-cycle briefing; record training attendance per member.
• Output: the reporting calendar, the briefing trigger, and the training record.
• Owner: the chair owns the calendar; the security officer owns the content and the trigger.

4. Deliverables#

Deliverable	Format	Template	Retention
Decision-rights map	document	template pending	Current version plus one cycle
One-page risk picture	xlsx or slide	/templates/one-page-risk-picture	Every published version, three years
Metric set with definitions and targets	xlsx	/templates/one-page-risk-picture	Definitions live; results three years
Management review record	minutes with decisions	template pending	Whole certification cycle
Decision log	register	/templates/one-page-risk-picture	Three years after the last row closes
Selected risk rows behind the picture	xlsx	/templates/risk-register	As the register

Retention periods above are organisational choices rather than requirements of any standard cited here.

5. What the auditor will ask#

An assessment that stays on the pack is going well. One that moves to the minute, and then to what happened after the minute, is where a reporting line built for applause fails.

6. Failure modes and how they surface as findings#

7. Mapping to standards#

Clause titles come from the ISO/IEC 27001:2022 contents. CSF 2.0 Category names and identifiers come from the CSF Core.

ISO/IEC 27001:2022 clause	CSF 2.0 Category	What the board sees	Evidence an assessor samples	Verified
5.1 Leadership and commitment	GV.RR Roles, Responsibilities, and Authorities	The mandate: who owns security risk, and with what authority	Minutes recording top management approvals and resourcing	13
5.2 Policy	GV.PO Policy	The policy put for approval and its review date	Approved policy, dated, with the approving role named	31
5.3 Organizational roles, responsibilities and authorities	GV.RR Roles, Responsibilities, and Authorities	The decision-rights map	Terms of reference and the delegation of authority	14
6.1.2 Information security risk assessment	GV.RM Risk Management Strategy	Criteria and appetite, put for approval	Approved criteria with a dated minute	4
6.1.3 Information security risk treatment	GV.RM Risk Management Strategy	Treatment options, cost, residual position, expiry	Treatment plan and the acceptance record	17
6.2 Information security objectives and planning to achieve them	GV.RM Risk Management Strategy	Objectives with targets and latest results	Objectives register across consecutive periods	18
9.1 Monitoring, measurement, analysis and evaluation	GV.OV Oversight	The metric set, with trend against target	Measurement results for three consecutive periods	6
9.3.2 Management review inputs	GV.OV Oversight	The pack itself, section by section	Input pack filed with the review record	22
9.3.3 Management review results	GV.OV Oversight	Decisions, owners and dates	Minute recording decisions rather than observations	23
10.2 Nonconformity and corrective action	GV.OV Oversight	Overdue actions, their cause and their closure	Finding register with cause, action and verification	27

The Annex A controls the reporting line rests on are cited in section 3: ISO/IEC 27002:2022 controls 5.1, 5.2, 5.4, 5.35, 5.36 and 8.16.

Supply chain reporting has its own Category, GV.SC Cybersecurity Supply Chain Risk Management. Supply chain risk processes there are identified, established, managed, monitored and improved by organisational stakeholders ³². Where suppliers carry material exposure, the picture needs a row for them.

8. Checklist#

• The decision-rights map names every body, what it may approve, and where its decisions are recorded.
• Every pack opens with one written decision request, not a summary.
• Risk acceptance criteria and the appetite statement carry a dated approval by a named role.
• The picture holds five to seven risk rows, and the rest sits in an appendix.
• Every selected row states owner role, position against appetite, trend and decision requested.
• Every risk owner confirmed their own row before the papers went out.
• Each row beyond appetite carries either a funded treatment or a dated acceptance with an expiry.
• The metric set has at most ten measures, each with a written definition and a source system.
• Each measure shows at least three consecutive periods against its target.
• At least one reported measure changed a decision in the last four cycles.
• The pack's sections map one to one onto the management review inputs.
• The management review record states decisions with owners and dates, not observations.
• The decision log carries every open item forward, with an age, until it closes on evidence.
• An independent review has reported to top management within the published interval.
• The reporting calendar and the paper deadlines are published to every body.
• A trigger for an out-of-cycle briefing is agreed and written down.
• Training attendance is recorded per member of the management body.
• The picture is versioned and dated, and superseded versions are retained.

References#

1. ISO/IEC. Information security, cybersecurity and privacy protection — Information security management systems — Requirements. ISO/IEC 27001:2022. Contents and clause titles read at https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-3:v1:en ³³
2. ISO/IEC. Information security, cybersecurity and privacy protection — Information security controls. ISO/IEC 27002:2022. Control numbers, titles and requirement text read in a licensed single-user copy ³⁴
3. National Institute of Standards and Technology. The NIST Cybersecurity Framework (CSF) 2.0. NIST CSWP 29, 26 February 2024. https://doi.org/10.6028/NIST.CSWP.29 ³⁵
4. European Parliament and Council. Directive (EU) 2022/2555 of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). OJ L 333, 27.12.2022, p. 80. https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng ³⁶
5. European Parliament and Council. Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector. OJ L 333, 27.12.2022, pp. 1-79. https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng ⁸

Cadences, retention periods and the count of measures above are organisational choices rather than requirements of any standard or instrument cited here.

Standards and certification names are the property of their respective owners. GRCIDE is an independent publication and is not affiliated with, authorized, sponsored or endorsed by ISO, IEC, NIST or any other standards body.